Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Account recovery is where most identity systems leak security, and PyPI is no exception. A close look at how recovery works today, where the edges are, and what enterprise publishers should plan around.
The 'could not find or load main class org.gradle.wrapper.GradleWrapperMain' error almost always means gradle-wrapper.jar is missing from your checkout. Here is why it happens and how to fix it safely.
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
A category map of web application security testing tools in 2026, from SAST and DAST to API scanners, and how to pick a stack that matches your architecture.
February 2026 at Safeguard: Lion behavioral baselines, Eagle base image advisories, Griffin reachability for Rust, and a new workflow editor.
Slopsquatting is the practice of registering package names that LLMs hallucinate, turning AI coding assistants into an accidental distribution channel.
Each major cloud provider approaches supply chain security differently. Here's a practical comparison and what it means for multi-cloud organizations.
Once a compromised dependency reaches a laptop or CI runner, you are doing incident response. Blocked at the Artifactory proxy, it is a log line. Here is the configuration that makes that happen.
A practical framework for evaluating application security testing services in 2026, from what should be included by default to the questions that separate a real program from a checkbox audit.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
